I'm also a bit confused by that. Websites can already do just as many malicious things when you interact anywhere else with JS enabled, so I don't see the security argument. They can also quite trivially insert invisible text if they for some reason want you to copy something different than what's displayed.
The main reasons I use built-in copy buttons are: A) I don't end up with bits of whitespace at the start and end of the text if it wasn't formatted well on the website. B) Normal copy-paste in a browser will also copy a bunch of HTML formatting data, which I almost never want in a code snippet. I don't want to have to install an extension just to get plaintext.